CVE-2015-3354

The CVE-2015-3354 entry concerns the Drupal Wishlist module (versions 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7). The vulnerability is a CSRF flaw that allows remote attackers to hijack the authentication of arbitrary users to perform actions deleting wishlist purchase intentions via unsp...

CVE-2015-3376

The CVE-2015-3376 entry relates to the Drupal Quizzler module (pre-7.x-1.16). The vulnerability is an XSS flaw that allows an authenticated remote user to inject arbitrary script/HTML via a node title. Affected versions are all prior to 7.x-1.16; the exploitation context is limited to module usag...

CVE-2015-3342

Open redirect vulnerability in the Ubercart Currency Conversion module before 6.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination query parameter...

CVE-2015-3376

Cross-site scripting XSS vulnerability in the Quizzler module before 7-x.1.16 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2015-3357

Cross-site scripting XSS vulnerability in the Wishlist module before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the "access wishlists" permission to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a log messa...

CVE-2015-3364

Cross-site scripting XSS vulnerability in the Content Analysis module before 6.x-1.7 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a log message...

CVE-2015-3353

CVE-2015-3353: XSS in Drupal Field Display Label module (7.x) prior to 7.x-1.3. Root cause: inadequate sanitization of the alternate field label in content types settings, allowing remote authenticated users to inject arbitrary script/HTML. Affected: Drupal 7.x-1.x before 7.x-1.3 (Field Display L...

CVE-2015-3364

The CVE-2015-3364 entry concerns the Drupal Content Analysis module (6.x-1.x) prior to 6.x-1.7. An XSS vulnerability arises from insufficient sanitization of input in log messages, allowing remote attackers to inject arbitrary script/HTML. Public disclosures and advisories confirm affected versio...

CVE-2015-3347

The CVE-2015-3347 entry concerns the Cloudwords for Multilingual Drupal module for Drupal 7.x before 7.x-2.3, where a Cross-Site Request Forgery (CSRF) vulnerability could allow remote attackers to hijack a victim’s authenticated session via an unspecified menu callback. Public references confirm...

CVE-2015-3351

Multiple cross-site request forgery CSRF vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable, 2 disable, or 3 delete a report via unspecified vectors...

CVE-2015-3368

Cross-site scripting XSS vulnerability in the administration user interface in the Classified Ads module before 6.x-3.1 and 7.x-3.x before 7.x-3.1 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a category name...

CVE-2015-3350

Cross-site request forgery CSRF vulnerability in the Todo Filter module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that toggle a task via unspecified vectors...

CVE-2015-3366

CVE-2015-3366 describes a CSRF vulnerability in the Drupal Alfresco module prior to 6.x-1.3. Affected component: Alfresco module (Drupal integration). Root cause: CSRF protection gaps allow remote attackers to perform actions on behalf of authenticated users, potentially deleting an Alfresco node...

CVE-2015-3370

Cross-site request forgery CSRF vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the authentication of users with the "nodeinvitecanmanageinvite" permission for requests that re-enable node invitations via unspecified vectors...

CVE-2015-3345

SQL injection vulnerability in the PHPlist Integration Module before 6.x-1.7 for Drupal allows remote administrators to execute arbitrary SQL commands via unspecified vectors, related to the "phpList database."...

CVE-2015-3371

The CVE-2015-3371 Open Redirect vulnerability affects the Drupal Node Invite module up to 6.x-2.x, specifically versions prior to 6.x-2.5. The issue arises from the destination parameter, allowing remote attackers to redirect users to arbitrary websites, enabling phishing. Affected component: Nod...

CVE-2015-3375

The CVE-2015-3375 entry concerns the Drupal Shibboleth Authentication module. A CSRF vulnerability allows remote attackers to hijack administrator authentication for requests that delete user role matching rules. Affected: Shibboleth Authentication module for Drupal 6.x-4.x before 6.x-4.1 and 7.x...

CVE-2015-3350

The CVE-2015-3350 issue affects the Drupal Todo Filter module, not Drupal core. Affected: Todo Filter 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1. Root cause: cross-site request forgery (CSRF) that lets remote attackers hijack a user’s authenticated session to toggle a task via unspecified ...

CVE-2015-3358

The CVE concerns the Drupal Tadaa! module (pre-7.x-1.4) which contains multiple open redirect vulnerabilities in its destination parameter used by callbacks that enable/disable modules or change variables. Attackers could lure users to arbitrary sites and conduct phishing via crafted URLs, as des...

CVE-2015-3345

The CVE-2015-3345 issue affects the Drupal PHPlist Integration Module (6.x-1.x) before 6.x-1.7. The vulnerability is an SQL injection that could allow remote administrators to execute arbitrary SQL commands via the phpList database. Root cause: the module’s integration points expose the Drupal/da...